GCP Professional Cloud Security Engineer Practice Question

An insurance company subject to GDPR will run nightly Spark jobs against customer PII. Corporate policy states that (1) data must never leave the European Union, (2) data at rest must be encrypted with customer-managed keys, and (3) compute instances must have no direct Internet exposure. You need to design the processing environment on Google Cloud with minimal operational overhead. Which solution satisfies every control?

Create an internal-only Dataproc cluster in europe-west3, store all data in a regional Cloud Storage bucket in europe-west3 protected by a Cloud KMS CMEK key, apply the gcp.resourceLocations organization policy to EU regions, and provide outbound Internet access through Cloud NAT.
Build a private GKE cluster in europe-west1, mount a multi-region EU Cloud Storage bucket with default encryption, and allow nodes to access package repositories via their own external IP addresses.
Deploy a managed instance group of Compute Engine VMs with public IPs in us-central1, store data in a multi-region EU Cloud Storage bucket encrypted with Google-managed keys, and block unwanted traffic using firewall rules.
Run Cloud Dataflow jobs in us-west1, keep datasets in a BigQuery US multi-region dataset encrypted with CMEK, and isolate projects with VPC Service Controls.

Report Issue

Answer Description

Using a Dataproc cluster avoids managing the OS and Spark stack while still giving fine-grained control over network configuration. Creating the cluster in a single EU region (e.g., europe-west3) and selecting the "internal IP only" option ensures no public IP addresses are assigned. Storing the raw and processed data in a regional Cloud Storage bucket in the same EU region preserves data residency, and attaching a Cloud KMS-managed CMEK key fulfils the customer-managed encryption requirement. Enforcing the organization policy constraint gcp.resourceLocations prevents accidental resource creation outside approved EU regions, while Cloud NAT lets the private cluster download required packages without exposing public IPs. The other options violate at least one control: they place resources in US regions, use Google-managed keys, or expose instances directly to the public Internet.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.